Privacy Policy

Section 01About this policy

1.1.HotDoc Online Pty Ltd ABN 84 159 662 558 (HotDoc) provides the ‘HotDoc’ online platform and website for booking and managing health appointments and clinical requests, supporting interaction and engagement between practices and patients, and providing other functionalities and services (Platform).

1.2.In terms of who is who, all references to ‘us,’ ‘we’ and ‘our’ in this Privacy Policy are references to HotDoc. All references to ‘you’ and ‘your’ in this Privacy Policy are references to:

a.the individual practitioners, employees and contractors of the health or medical clinics, hospitals or other healthcare provider organisations (Practices) who are customers, or potential customers, of our Platform, products and services (Practice Representatives);

b.the patients or other individuals who use our Platform or services (such as to make an online booking, communicate with a Practice, or use other functionalities), or who otherwise receive communications from their Practice via our Platform (Patients); and

c.our individual contractors and suppliers, potential employees, other website users and any other individuals we might deal with in running our business or providing our services.

1.3.We know that your privacy is important to you – it’s important to us as well. We publish this Privacy Policy to make it easier for you to understand the types of personal information we might collect, why and how we might use, disclose or otherwise handle it, and the rights you have to access or correct it.

1.4.When this Privacy Policy refers to ‘personal information,’ this term has the meaning given to it by the Privacy Act 1988 (Cth) (Privacy Act) and includes information or an opinion about an individual which is reasonably capable of identifying that individual (and might include their health or other sensitive information) (Personal Information). We’re committed to protecting and dealing with your Personal Information in ways that comply with the Privacy Act and any other applicable health records or privacy laws.

1.5.If you have any questions, concerns or feedback about this Privacy Policy, please contact us using our contact details contained in section 10 below.

Section 02A bit about our Platform

2.1.To properly understand our Personal Information-handling, you need to understand a bit about our Platform and what it does.  At its core, our Platform provides a means of connecting Patients and Practices and supporting their interactions and engagements. It also assists Patients and Practices to manage their health information and health records.

2.2.Some of the functionalities of our Platform (which will be relevant to the types of Personal Information we deal with) include enabling:

a.Practices and Patients to create and manage an online profile;

b.Practices and Patients to manage and hold health appointments (such as by booking, cancelling and rescheduling appointments, or holding those appointments via our video platform, or accessing ‘Telehealth On Demand’ when their regular Practice is unavailable);

c.Practices to communicate with Patients about their appointment or other important matters (such as reminders, recalls, and other Practice notifications), and to simplify their practice management, document management and triaging, and in-bound phone call triaging via our feature known as ‘Voice Reception’ (Voice Reception), if and as that is made available;

d.digital forms to be completed by Patients ahead of their appointment, and in some instances, payment for that appointment to be processed;

e.Patients to request a ‘Routine Request’ for repeat prescriptions, referrals or medical certificates (by electronic or other means) from their Practice;

f.Patients to request via ‘Patient Notes’ details of any ‘Telehealth On Demand’ consultations be sent by that practitioner to their regular Practice and/or to themselves;

g.where it is made available, Patients to store, view and manage their prescription information within a single digital location via ‘Health Wallet’ (Health Wallet);

h.key integrations, such as those which enable Practices to conduct online patient verification (OPV) of Patients’ Medicare and Department of Veterans’ Affairs (DVA) details prior to an appointment (OPV functionality), upload their Patients’ immunisation information to the Australian Immunisation Register (AIR) following an immunisation appointment (AIR integration functionality), or import or download an electronic prescription via Health Wallet; and

i.support for public healthcare initiatives, such as enabling bookings for the Australian Government temporary respiratory clinic that was set up as part of the COVID-19 pandemic response (Respiratory Clinic).

Section 03The types of Personal Information we collect

To provide our services and run our business, we need to collect Personal Information. We may collect and hold your Personal Information for a range of reasons, such as to allow us to identify who an individual is before they access or use the Platform, to facilitate bookings or communications between Patients and their Practice, enable other Platform functionalities, or to generally work and deal with individuals in the ordinary course of business.  You can click through the policy below to read more about the types of Personal Information we collect for different categories of individuals we deal with.

3.1.If you are a Patient:

a.We will generally collect Personal Information about you in one of two ways:

i.directly from you or from a person who is authorised to act on your behalf (such as a legal guardian or representative) when you or they access or use the Platform, or use any Voice Reception functionality that has been implemented by a Practice for telephone appointment bookings; or

ii.from a Practice that you are a patient of, or have made a booking with, to enable the Platform’s functionality or our provision of services to that Practice (and only as necessary to support those functionalities or services, not to commercialise the information);

b.The types of Personal Information we may collect, depending on the circumstances, include:

i.General information such as your name, location, date of birth, gender, family details including marital status, contact information (including your email address, telephone and fax number, residential, business and postal addresses), your registration details for the Platform, and details of your use of, or access to, the Platform. From time to time, this may include your government related identifiers (such as Medicare details, your individual healthcare identifier and other identifiers used to verify your identity);

ii.health information such as information about your health, the health services which have been or are to be provided to you, or other information which falls within the scope of ‘health information’ as that term is defined in the Privacy Act. Some common examples of the types of health information we might collect (which will depend on how you and your Practice interact with our Platform and Services) include: details of your appointments booked, confirmed or cancelled; the content of other communications or interactions you and your Practice have via the Platform; information contained in a digital form you complete via our Platform; information about and copies of any prescriptions you store or seek to fulfil, or repeat referrals you request, via the Platform; or a clinical summary of any ‘Telehealth On Demand’ consultation you attend, if you request that this be shared by the relevant practitioner with your regular Practice and/or to yourself;

iii.other ‘sensitive information’ as that term is defined in the Privacy Act (excluding health information, which is addressed above), such as information which might relate to, among other things, your racial or ethnic origin, sexual orientation or practices, criminal record or religious or philosophical beliefs. We will only collect this type of information if you or your Practice provide it to us directly;

iv.if you use our location-based appointment search functionality, the approximate location information you submit to the Platform or share from your device;

v.if you use our ‘check-in’ functionality, your location information at the time you check in to the relevant Practice (though this will only be captured if you allow it on your device’s settings);

vi.if you process a payment or other financial transaction with your Practice via the Platform, general details of that transaction (including a record), however credit card information will be held by a secure payment provider to ensure it is kept safe. We don’t see your full credit card number, nor do we store it, though we do have the ability to transact on your behalf to enable payment processing only;

vii.if you are a Patient of a Practice that is using AIR integration functionality and you attend an immunisation appointment made via our Platform, your Medicare number and specific immunisation identifier. Note that if this is relevant, this information is collected from third parties such as Services Australia and claiming.com.au via software integrations with their services;

viii.if you are a Patient of a Practice that is using OPV functionality, your Medicare, DVA or pension/healthcare card details (including number, cardholder name, reference number and expiry date) and OPV results (i.e. ‘valid’ or ‘not valid’), if and as applicable. Note that if this is relevant, this information is also collected from third parties such as Services Australia, the DVA, and claiming.com.au via software integrations with their services;

ix.if you are a Patient of a Practice that is using our ’Document Assistant’ functionality (Document Assistant), a copy of the relevant records or documentation that is being uploaded to their practice management system via our Platform (this can include referrals, results and other clinical records or related correspondence);

x.if you are a Patient of a Practice that is using Voice Reception, information about and recordings or transcripts of your in-bound phone call to that Practice (if you provide your consent for us to do so); and

xi.any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you.

c.If you use or access our Platform (including the website) or receive communications from us or from a Practice via the Platform, we may also collect browsing and analytical information (including information about your online preferences, behaviours, movement and engagement) about you which is obtained from cookies (a small tracking code in Your browser) and other tracking pixels. This information may be collected on an identifiable basis.

3.2.If you are a Practice Representative:

a.Most Personal Information we collect about you will be received from you directly, your patients or potential patients, or the Practice that employs or otherwise engages you. However, and depending on the nature of your relationship (or potential relationship) with us, we may also collect your Personal Information from other sources such as advertising, public records, mailing lists, contractors, our staff and our business partners. We may also display online reviews of Practices on the Platform, which may refer to you personally; and

b.the types of Personal Information we may collect about you include:

i.general information such as your name, location, date of birth, contact information (including your email address, telephone and fax number, residential, business and postal addresses), your log-in details for the Platform, and details about your use of, or access to, the Platform;

ii.financial information such as any of your bank or credit card details used to transact with us, or other financial information that allows us to transact with you or provide you with our services;

iii.details of any communications or interactions you have with a patient using the Platform or that a patient otherwise provides to us – for example, details of an appointment with you that is managed using the Platform (and any related communications), or a Patient’s nomination of you as their treating practitioner, or a copy of a prescription you have issued that is stored within a Patient’s Health Wallet;

iv.as relevant to your relationship with us, information we collect or generate about your online preferences and activity, how you use our Platform and services, your demographic location information, trends, decisions and other statistical, behavioural or analytical information which is typically obtained from cookies and other tracking pixels, and analytical services (although you can adjust your browser’s settings to accept or reject cookies), and other information about your preferences and purchases in relation to our products;

v.information about your professional registration, credentials and experience, associations or memberships, or any other information that you or your Practice provide about you to be published on your profile or listing;

vi.if you are a Practice Representative at a Practice that is using AIR integration functionality and you administer an immunisation to a Patient, or if your patient stores a prescription you have issued in their Health Wallet, your practitioner provider number and Healthcare Provider Identifiers – Individual (HPI-I); and

vii.any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you.

3.3.If you are a contractor or supplier, potential employee, other website user, or any other individual we deal with in running our business:

a.most Personal Information we collect will be received from you directly, however depending on the circumstances it might also be collected from third parties such as recruitment agencies, reference check providers, or our business partners; and

b.the types of Personal Information we might collect about you will ultimately differ based on the circumstances, but might include:

i.your name and contact details;

ii.your professional qualifications or skills;

iii.details of your employment history (including details of any personal or professional references provided to us by third parties);

iv.financial information such as any of your bank or credit card details used to transact with us;

v.if you use or access our Platform or website, or receive subscription or other digital communications from us, we may collect statistical information using cookies or analytical services (although you can adjust your browser’s setting to accept or reject cookies), or by using pixel tags, which enable us to send email or SMS messages in a format customers can read and they tell us whether the relevant communication has been opened or received. This information may in some circumstances be collected on an identifiable basis; and

vi.any other Personal Information you send or disclose to us, including our records of any communications or interactions we have with you.

Section 04How Personal Information is used and disclosed

The primary purposes for which we collect Personal Information are to enable the functionality of the Platform (you can read more about those functionalities in section 2 above), provide you or your Practice with our services, and to support the operation of our business. How we use or disclose your Personal Information will generally be tied to these primary purposes – but please click through below to read more about our uses and disclosures for the different categories of individuals we deal with.

4.1.If you are a Patient:

a.we are not interested in making money out of trading your Personal Information, and we will not sell it or exploit it outside of the purposes described in this Privacy Policy.

b.we will use your Personal Information (including your health and other sensitive information) for the primary purpose for which we collected it (for example, to register your account for the Platform, or communicate with you about an appointment you have booked with a Practice, or offer and provide you other Platform functionalities that assist you or the Practice to manage your healthcare services);

c.from time to time we may use your Personal Information for secondary purposes if you have provided your consent for us to do so (for example, if you request that a summary of any ‘Telehealth On Demand’ consultation you attend be shared by the relevant practitioner with your regular Practice), or if you might reasonably expect us to do so and it’s related to the primary purpose for which we collected the Personal Information (for example, to investigate or respond to a complaint that you have raised with us, or to verify your identity if you have forgotten your user details for the Platform, or to engage in or enable direct marketing based on your online preferences and behaviours, where this is authorised by law). Other secondary purposes we may use your Personal Information for include for understanding, developing, assessing and improving the Platform, how it is used, and our products and services, or to generate aggregated analytical data to inform such activities;

d.we maintain all Personal Information (especially health information) in strict confidence, and will only disclose it to third parties:

i.to enable us to provide you with your use of the Platform or our services;

ii.to enable your Practice to keep up to date records, communicate with you, provide you with their health services and to verify your identity;

iii.who assist us with our reasonable business operations and Platform functionalities; or

iv.provide certain services to you or facilitate payment for an appointment via the Platform; or

e.if we are otherwise authorised or required to do so under relevant laws, such as if you have given your express consent, or particular circumstances exist to authorise the disclosure – for example if it’s reasonably necessary due to law enforcement activities, or to lessen a serious threat to the life, health or safety of any individual.

f.the types of third parties that we might generally disclose your Personal Information to for the above purposes include:

i.the Practice that you have previously had, or intend to book, an appointment with or otherwise communicate or interact with via the Platform;

ii.the Practice that you have nominated as your regular Practice; and

iii.our service providers who support and enable us to provide our services and run our business, such as:

A.our information technology, network, software and cloud storage providers, including support service and messaging, cookies/pixels and analytical service providers, or email, SMS or push notification services providers;

B.any practice management software providers which your Practice uses, to enable the Practice to communicate or interact via the Platform;

C.our payment providers to ensure that your financial information is kept safe; and

D.our external professional advisers (such as legal advisors).

4.2.If you are a Practice Representative:

a.we will use your Personal Information (including your financial information) for the primary purposes of providing you or your Patients with our services or enabling your use of the Platform, such as to:

i.communicate with you, including about an appointment or patient communication;

ii.monitor your use of the Platform or our services;

iii.publish your profile or listing online;

iv.enable Patients to book appointments or communicate with you via the Platform;

v.enable patients to request that details of any ‘Telehealth On Demand’ consultations you provided to them be sent to their regular Practice and/or to the patients themselves;

vi.enable Patients to store their health information (such as prescription information within Health Wallet, or other records) within the Platform;

vii.verify your identity; and

viii.perform billing and payment activities; and

b.we may also use your Personal Information (including your financial information) for some secondary purposes, such as:

i.communicating with you about:

A.your relationship with us;

B.our goods and services;

C.our own marketing or promotions; or

D.competitions, surveys and questionnaires;

ii.for developing, assessing and improving the Platform and our products and services, or to generate analytical data to inform such activities;

iii.investigating any issues or complaints about, or made by, you or another individual, or if we have reason to suspect that you or another individual are in breach of any of our terms and conditions or have been otherwise engaged in any unlawful activity; or

iv.any other purposes which are required or authorised by any laws (including the Privacy Act);

c.we will only disclose your Personal Information to third parties where this is reasonably necessary to enable us to operate our business or provide you with our services and the use of the Platform, or as is otherwise required or authorised by any laws (including the Privacy Act);

d.the types of third parties we may generally disclose your Personal Information to for the above purposes include:

i.your Patients or potential patients;

ii.any individuals or entities, including members of the general public, who access your details published on the Platform;

iii.the Practice that employs or engages you;

iv.the regular Practice of any of your ‘Telehealth On Demand’ patients;

v.our service providers such as those which provide us with:

A.our information technology, network, software, cookies/ pixels and analytics, and cloud storage providers;

B.the practice management software provider used by the Practice that employs or engages you;

C.subscription and mailing operations;

D.billing and related financial functions; and

E.our external professional advisers, such as legal advisors or accountants; and

e.other third parties that we might disclose your Personal Information for the purposes of a specific Platform functionality (in addition to the disclosures described above). For example, if you are a Practice Representative at a Practice that is using AIR integration functionality and you administer an immunisation to a Patient, we may, for the purposes of enabling the Practice to upload Patient immunisation information to the AIR using the Platform, disclose details of the immunisation appointment, your provider number and HPI-I in relation to an immunisation you administered.

4.3.If you are a contractor or supplier, potential employee, other website user, or any other individual we deal with in running our business:

a.we will only use or disclose any Personal Information that we collect for the purpose for which it was collected, or for any secondary purposes which you might reasonably expect and which are related to the primary purpose; and

b.the primary purpose of our collection can generally be determined by the circumstances in which the information was collected or submitted. For example, if you are a potential employee and provide us with your CV, we will use it for the purposes of assessing your application for employment and may disclose your details, as necessary, to our staff and anyone that we contact for the purposes of a reference check.

Section 05Overseas recipients

5.1.While all Personal Information is hosted and stored on our Australian servers, the types of disclosures described in section 4 might also involve your Personal Information being sent to some overseas recipients, including:

a.our software and other service providers located in the United States of America and the United Kingdom;

b.other service providers and sub-processors described in our Trust Centre (as may be updated from time to time); and

c.members of our staff who might be working remotely from overseas locations;

5.2.It’s important to note that the location of any overseas recipients may change from time to time, depending on the particular service providers we engage and the way in which you interact with the Platform and our services.

Section 06Automated decision-making

6.1.Some functionalities of the Platform use computer programs, including rules-based logic and software-enabled processes, to assist with certain operational and service-related decisions (the Automated Processes).

6.2.In limited circumstances, Automated Processes may be used to make, or to do things that are substantially and directly related to making, decisions that could impact an individual’s rights or interests. These decisions are not intended to replace clinical judgment or professional decision-making by Practitioners, and are always subject to human verification.

6.3.Depending on the relevant functionality, Automated Processes may use Personal Information such as general account, booking, usage or interaction information, and, where necessary, health information to support a feature that a Patient or Practice has chosen to use.

6.4.The kinds of decisions supported by Automated Processes may include facilitating appointment and document management and triaging (via Document Assistant), routing or prioritising communications (including via Voice Reception), enabling identity or eligibility checks, managing our responses to external queries from Patients and Practices, and supporting other Platform features from time to time. Automated Processes generally operate within broader service workflows and may be subject to human oversight or intervention by us, the relevant Practice, or both.

Section 07Opting out

7.1.An individual may opt not to have us collect their Personal Information, or for us to de-identify any Personal Information we hold about them. Of course, this may mean that we can’t provide them with some or all of our services, and need to terminate their access to the Platform.

7.2.To request such an opt out or de-identification, please contact us using our contact details contained in section 10 below. We will assess whether doing so complies with relevant laws, and provide you with a response to your request.

7.3.An individual may also opt out of receiving any marketing or promotional communications from us (this can be done at any time by following the unsubscribe instructions in the relevant communication). Any such opt-out will not affect the provision of our core services or any transactional or clinical messages you receive from us.

7.4.If an individual believes that they have received information from us that they did not wish to receive, they should contact us on the details above to unsubscribe from that sort of communication.

Section 08Keeping your Personal Information secure

8.1.We will take all reasonable precautions to protect your Personal Information from unauthorised access or disclosure, or misuse or loss.

8.2.Some of these precautions include:

a.appropriately securing our physical facilities, systems and electronic networks with at least standard industry protections;

b.undergoing external security assessments and auditing, such as through SOC2 certification and bug bounty testing;

c.using standard industry encryption methods and, where appropriate, multi-factor authentication when storing and transferring Personal Information;

d.implementing monitoring and access controls that regulate who can access particular information;

e.requiring our team and service providers to comply with confidentiality obligations before they access Personal Information;

f.conducting background checks on our staff before they commence work for us;

g.reviewing changes to our Platform to ensure these meet our privacy and security commitments; and

h.ensuring all our staff use multi-factor authentication when accessing our systems.

8.3.Your Personal Information will be stored in secure, encrypted electronic format and will be stored in Australia.

8.4.We will only retain Personal Information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Section 09How to access, correct or update your Personal Information

9.1.Under the Privacy Act, you have the right to request access to, or correction of, the Personal Information that we hold about you.

9.2.If you would like to make such a request, you can:

a.if you are a user of the Platform, update some of your Personal Information or delete some of your Personal Information from within your Patient account or Practitioner profile; or

b.otherwise contact us using the details in section 10 to request access or correction.

9.3.If you contact us directly to make the request, we will take reasonable steps to:

a.correct any errors within a reasonable time from receiving the written notice of those errors; or

b.provide you with access within 30 days of receipt of a written request.

9.4.We may charge you a reasonable fee for our costs in providing you with access to your Personal Information, but we’ll let you know about this once we’ve processed the initial request.

9.5.If we deny you access to or we refuse your request to correct your Personal Information, we’ll give you our reasons for this in writing.

Section 10Contacting us and complaints

10.1.All questions, comments, requests or complaints regarding this Privacy Policy or the way in which we handle your Personal Information can be addressed in writing to:

a.by email: [email protected]; or

b.by post:

The Privacy Officer

HotDoc Online Pty Ltd

Level 7, 276 Flinders Street

Melbourne VIC 3000

10.2.We will aim to resolve any issue raised with you directly and promptly.

10.3.If you are not satisfied with our response to any complaint, you can also lodge a complaint with the Office of the Australian Information Commissioner:

a.by phone: 1300 363 992; or

b.online at: www.oaic.gov.au.

Section 11Changes to this policy

11.1.From time to time, we may need to change this Privacy Policy, without notice. If we do, we will post the updated Privacy Policy on our website.

11.2.You should review this Privacy Policy from time to time to review any changes. Any revised Privacy Policy, once published on our website, will apply to all Personal Information that is handled by us.